Analysis
-
max time kernel
142s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-09-2024 21:52
Static task
static1
Behavioral task
behavioral1
Sample
2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe
Resource
win10v2004-20240802-en
General
-
Target
2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe
-
Size
614KB
-
MD5
b97014f2bde6c236cc053f3c256c8e70
-
SHA1
cf91bbf30f96f5660716c0145a98ad744aaff802
-
SHA256
2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12
-
SHA512
b290172913bb7f94f95d38400c28e1b3fb22def02f43e8e81cc80aec1d68e236bea13d1e19c97020b7bb2384d966d56ea70f2caaf0edb1089d60bb1408851211
-
SSDEEP
12288:71nYIsq+lFF7SAlF3mUAwx/UprNF3Z4mxxBDqVTVOCL:ZnTwFQK3RAw/UTQmXIVTzL
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
resource yara_rule behavioral1/memory/2232-2-0x0000000000400000-0x000000000056A000-memory.dmp modiloader_stage2 behavioral1/memory/2564-90-0x0000000000400000-0x000000000056A000-memory.dmp modiloader_stage2 behavioral1/memory/2232-98-0x0000000000400000-0x000000000056A000-memory.dmp modiloader_stage2 behavioral1/memory/2564-106-0x0000000000400000-0x000000000056A000-memory.dmp modiloader_stage2 behavioral1/memory/2232-119-0x0000000000400000-0x000000000056A000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 620 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2564 amcap.exe -
Loads dropped DLL 5 IoCs
pid Process 2232 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe 2232 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe 2508 WerFault.exe 2508 WerFault.exe 2508 WerFault.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\H: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\O: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\Q: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\B: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\E: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\G: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\M: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\U: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\W: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\Z: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\K: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\N: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\P: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\R: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\S: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\X: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\I: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\J: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\L: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\T: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\V: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened (read-only) \??\Y: 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\AutoRun.inf 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened for modification C:\AutoRun.inf 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File created F:\AutoRun.inf 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened for modification F:\AutoRun.inf 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\amcap.exe 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\amcap.exe 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\_amcap.exe amcap.exe File opened for modification C:\Windows\_amcap.exe amcap.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2508 2564 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language amcap.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2564 2232 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe 30 PID 2232 wrote to memory of 2564 2232 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe 30 PID 2232 wrote to memory of 2564 2232 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe 30 PID 2232 wrote to memory of 2564 2232 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe 30 PID 2564 wrote to memory of 2508 2564 amcap.exe 31 PID 2564 wrote to memory of 2508 2564 amcap.exe 31 PID 2564 wrote to memory of 2508 2564 amcap.exe 31 PID 2564 wrote to memory of 2508 2564 amcap.exe 31 PID 2232 wrote to memory of 620 2232 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe 33 PID 2232 wrote to memory of 620 2232 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe 33 PID 2232 wrote to memory of 620 2232 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe 33 PID 2232 wrote to memory of 620 2232 2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe"C:\Users\Admin\AppData\Local\Temp\2235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\amcap.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\amcap.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 3003⤵
- Loads dropped DLL
- Program crash
PID:2508
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat""2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248B
MD57354947f014999e10ef52eda93d4a343
SHA1eb66e61390f0bb102ea42538e3557d61d8ee0b73
SHA25602afab3c3dd9eac72804d7b3f8b985e126bf3398af41d40234e10ac3848c2704
SHA5127e47992661f54e9df2071576fd95b49ff86e83358ecf3fd4c0160ec38cfa714b0ac83def5ecebeccc2673eb5156a3a3f3d109851ef16fe9ce23a3237dcab125a
-
Filesize
614KB
MD5b97014f2bde6c236cc053f3c256c8e70
SHA1cf91bbf30f96f5660716c0145a98ad744aaff802
SHA2562235a214970f2c21478ce08c12f09986319b24320657b3ef447273c039d71d12
SHA512b290172913bb7f94f95d38400c28e1b3fb22def02f43e8e81cc80aec1d68e236bea13d1e19c97020b7bb2384d966d56ea70f2caaf0edb1089d60bb1408851211